9672d187e3c2b6ebb2e675a8f91a9d37e648096325774cb3c0966654bbd56bed

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:18

Target

0cbdc4e3000b1bc7da63d1151812a23e.exe
Size

123KB
MD5

0cbdc4e3000b1bc7da63d1151812a23e
SHA1

b040dbefd7699c3d50e8648d0482375a21f7de2f
SHA256

9672d187e3c2b6ebb2e675a8f91a9d37e648096325774cb3c0966654bbd56bed
SHA512

00139cca942a7b2209c136f2dc574f0eb2efb0f22b9288a1849e6bab068acbb186ca3e7263b9c1c703519b6fe7b730b32509cd4a474a3955c16f4174b9e3b2a6
SSDEEP

3072:CNcQAcbSaLCSqITbav/evAkjIQhpi59jxvUoS:wscbSaLCSFbauvrIQhpiHj5Uj

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/776-0-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/776-1-0x0000000000400000-0x0000000000445000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3044	776	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 3044	776	0cbdc4e3000b1bc7da63d1151812a23e.exe	28
PID 776 wrote to memory of 3044	776	0cbdc4e3000b1bc7da63d1151812a23e.exe	28
PID 776 wrote to memory of 3044	776	0cbdc4e3000b1bc7da63d1151812a23e.exe	28
PID 776 wrote to memory of 3044	776	0cbdc4e3000b1bc7da63d1151812a23e.exe	28

C:\Users\Admin\AppData\Local\Temp\0cbdc4e3000b1bc7da63d1151812a23e.exe
"C:\Users\Admin\AppData\Local\Temp\0cbdc4e3000b1bc7da63d1151812a23e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 136
  2⤵
  - Program crash
  PID:3044

memory/776-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/776-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download